Stack Overflow Vulnerability in ImageMagick Products by ImageMagick
CVE-2026-109267

6.9MEDIUM

Key Information:

Vendor

Imagemagick
Status
Imagemagick
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109267?

ImageMagick versions prior to 6.9.13-57 and 7.x versions before 7.1.2-32 are susceptible to a stack overflow vulnerability within the MSL decoder. This flaw arises from an inadequate depth check that fails to restrict recursion levels. By supplying specially crafted MSL images, an attacker can exploit this vulnerability, potentially leading to a stack exhaustion, crashing the process and resulting in a denial of service.

Affected Version(s)

ImageMagick 7.0.0-0 < 7.1.2-32

ImageMagick 0 < 6.9.13-57

ImageMagick 7.1.2-32

References

https://github.com/ImageMagick/ImageMagick/security/advis...
vendor-advisory
https://github.com/ImageMagick/ImageMagick/commit/507aee2...
patch
https://github.com/ImageMagick/ImageMagick6/commit/c10823...
patch

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Kushalkhemka
opensec-intelligence
mayank-jangid-moon
skigeek16
.